Replying to Avatar Vitor Pamplona

What if the malicious client sends an invisible DM to the attacker not only with your nsec but with also your Nostr Wallet Connect secret?

Since you are not verifying your zaps out, they can just slowly drain your funds forever.
Avatar
vnprc 10mo ago

I don't use NWC. Too low friction. Bad security posture.

However, doesn't NWC have spend limits for this reason?

Reply to this note

Please Login to reply.

Discussion

Avatar
Vitor Pamplona 10mo ago

Yep, but if people don't check where each individual zap is going then who knows which wallet is actually receiving them. A malicious client can create a zap for A to receive but with B's address.